ID

VAR-202007-1133

CVE

CVE-2020-6514

TITLE

Google Chrome Security hole

DESCRIPTION

Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream. Google Chrome is a web browser developed by Google (Google). WebRTC is one of the components that supports browsers for real-time voice or video conversations. A security vulnerability exists in WebRTC in versions prior to Google Chrome 84.0.4147.89. An attacker could exploit this vulnerability to bypass security restrictions. For the stable distribution (buster), these problems have been fixed in version 68.11.0esr-1~deb10u1. We recommend that you upgrade your firefox-esr packages. For the detailed security status of firefox-esr please refer to its security tracker page at: https://security-tracker.debian.org/tracker/firefox-esr Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl8huUkACgkQEMKTtsN8 TjZrWRAAmJKPn+TnXVDcxt9OC/ko2aovs7IotOScCOvjO9Aez+l64cUEOAj4Zxc1 gd/CC/fW/LNudbmLrMKjGft3bFwi/78htATpgcJE5diEjEVlyvgMJiwvwoN+zOO2 1u4hgN6sYiBVnEKBOtS3wA0VGa19tW5mWXWZgtfmEMfuNpz3bUQ8ApQ48M47VdUO JjZbtTP92N8h99Mko3k2Z2xUDimRZ0xvVYXmEQ9lUzQnNpz0yKwSuo/GsjnH3l1n 2Y8ih+m9pCuYfcpXvWtLlQc70koS84MaAzdqYsp1xMpXLHzejDM/e0oDEJppBjwP 0U4qHSbirlwMHn1PSILFsDjYfTwSmFUqvmPb9mcPMnz60xuh6IT+2RUKXekBo263 1uhlHgqd5+hWYuWxQz7FgssJVUzfH2ZzaIoTRTYtTQVJmHeYViWf54AEGP36D6++ I8tNyCVTbDW+114dWjAmkuQ+yVjt0eSb4rqLqwcKxvNT6cCzRRJp2/tSsQCAvFdB dzExvQQMD/t4o+0BUYxani0jJf9DR9N7BoUBQdI0eZNV/mJ1BmDWXJqEpExhilfb 9QlI6oRu/Cw05BpkD1FKeXR+MgMKpi/jubhsYkZQcV9t7C0D/L13DEAqxr4zi4te eLLP/BQ3bl+h71ZHBCYCpbCc+joreguC3Z09IaDYFafewmOACHs= =QMwo -----END PGP SIGNATURE----- . ========================================================================== Ubuntu Security Notice USN-4443-1 July 29, 2020 firefox vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Firefox could be made to crash or run programs as your login if it opened a malicious website. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass iframe sandbox restrictions, confuse the user, or execute arbitrary code. (CVE-2020-6463, CVE-2020-6514, CVE-2020-15652, CVE-2020-15653, CVE-2020-15654, CVE-2020-15656, CVE-2020-15658, CVE-2020-15659) It was discovered that redirected HTTP requests which are observed or modified through a web extension could bypass existing CORS checks. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit this to obtain sensitive information across origins. (CVE-2020-15655) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS: firefox 79.0+build1-0ubuntu0.20.04.1 Ubuntu 18.04 LTS: firefox 79.0+build1-0ubuntu0.18.04.1 Ubuntu 16.04 LTS: firefox 79.0+build1-0ubuntu0.16.04.2 After a standard system update you need to restart Firefox to make all the necessary changes. 8.0) - ppc64le, x86_64 3. Description: Mozilla Thunderbird is a standalone mail and newsgroup client. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202007-64 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Mozilla Thunderbird: Multiple vulnerabilities Date: July 31, 2020 Bugs: #734978 ID: 202007-64 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 mail-client/thunderbird < 68.11.0 >= 68.11.0 2 mail-client/thunderbird-bin < 68.11.0 >= 68.11.0 ------------------------------------------------------------------- 2 affected packages Description ========== Multiple vulnerabilities have been discovered in Mozilla Thunderbird. Please review the CVE identifiers referenced below for details. Impact ===== Please review the referenced CVE identifiers for details. Workaround ========= There is no known workaround at this time. Resolution ========= All Mozilla Thunderbird users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=mail-client/thunderbird-68.11.0" All Mozilla Thunderbird binary users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=mail-client/thunderbird-bin-68.11.0" References ========= [ 1 ] CVE-2020-15652 https://nvd.nist.gov/vuln/detail/CVE-2020-15652 [ 2 ] CVE-2020-15659 https://nvd.nist.gov/vuln/detail/CVE-2020-15659 [ 3 ] CVE-2020-6463 https://nvd.nist.gov/vuln/detail/CVE-2020-6463 [ 4 ] CVE-2020-6514 https://nvd.nist.gov/vuln/detail/CVE-2020-6514 [ 5 ] MFSA-2020-35 https://www.mozilla.org/en-US/security/advisories/mfsa2020-35/ Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202007-64 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2020 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: firefox security update Advisory ID: RHSA-2020:3233-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:3233 Issue date: 2020-07-29 CVE Names: CVE-2020-6463 CVE-2020-6514 CVE-2020-15652 CVE-2020-15659 ==================================================================== 1. Summary: An update for firefox is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - x86_64 3. Description: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 68.11.0 ESR. Security Fix(es): * chromium-browser: Use after free in ANGLE (CVE-2020-6463) * chromium-browser: Inappropriate implementation in WebRTC (CVE-2020-6514) * Mozilla: Potential leak of redirect targets when loading scripts in a worker (CVE-2020-15652) * Mozilla: Memory safety bugs fixed in Firefox 79 and Firefox ESR 68.11 (CVE-2020-15659) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Firefox must be restarted for the changes to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1840893 - CVE-2020-6463 chromium-browser: Use after free in ANGLE 1857349 - CVE-2020-6514 chromium-browser: Inappropriate implementation in WebRTC 1861570 - CVE-2020-15652 Mozilla: Potential leak of redirect targets when loading scripts in a worker 1861572 - CVE-2020-15659 Mozilla: Memory safety bugs fixed in Firefox 79 and Firefox ESR 68.11 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: firefox-68.11.0-1.el6_10.src.rpm i386: firefox-68.11.0-1.el6_10.i686.rpm firefox-debuginfo-68.11.0-1.el6_10.i686.rpm x86_64: firefox-68.11.0-1.el6_10.x86_64.rpm firefox-debuginfo-68.11.0-1.el6_10.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): x86_64: firefox-68.11.0-1.el6_10.i686.rpm firefox-debuginfo-68.11.0-1.el6_10.i686.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: firefox-68.11.0-1.el6_10.src.rpm x86_64: firefox-68.11.0-1.el6_10.i686.rpm firefox-68.11.0-1.el6_10.x86_64.rpm firefox-debuginfo-68.11.0-1.el6_10.i686.rpm firefox-debuginfo-68.11.0-1.el6_10.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: firefox-68.11.0-1.el6_10.src.rpm i386: firefox-68.11.0-1.el6_10.i686.rpm firefox-debuginfo-68.11.0-1.el6_10.i686.rpm ppc64: firefox-68.11.0-1.el6_10.ppc64.rpm firefox-debuginfo-68.11.0-1.el6_10.ppc64.rpm s390x: firefox-68.11.0-1.el6_10.s390x.rpm firefox-debuginfo-68.11.0-1.el6_10.s390x.rpm x86_64: firefox-68.11.0-1.el6_10.x86_64.rpm firefox-debuginfo-68.11.0-1.el6_10.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): x86_64: firefox-68.11.0-1.el6_10.i686.rpm firefox-debuginfo-68.11.0-1.el6_10.i686.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: firefox-68.11.0-1.el6_10.src.rpm i386: firefox-68.11.0-1.el6_10.i686.rpm firefox-debuginfo-68.11.0-1.el6_10.i686.rpm x86_64: firefox-68.11.0-1.el6_10.x86_64.rpm firefox-debuginfo-68.11.0-1.el6_10.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): x86_64: firefox-68.11.0-1.el6_10.i686.rpm firefox-debuginfo-68.11.0-1.el6_10.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-6463 https://access.redhat.com/security/cve/CVE-2020-6514 https://access.redhat.com/security/cve/CVE-2020-15652 https://access.redhat.com/security/cve/CVE-2020-15659 https://access.redhat.com/security/updates/classification/#important https://www.mozilla.org/en-US/security/advisories/mfsa2020-31/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXyH6mdzjgjWX9erEAQiukRAAoSy1u1yd2aSJw+foZEA/YHyuL6bfn+/t /PZHIx68QEOtgGGg91+VR1THGCZWW3FYUJfEIfDu61SzkuSNECyrJNus2NSw9XJk JiK4YYJ2Ga2LWKXhmhJqMyi7uzpxb/yLRIZn6/X4vGqld6SjiXi+J7yX/ctEYI5S tpBcOmYFj/uB0He+BxtaRWBY26cPAeD1SbTLWmMq2+aOMBJ8tujvQFCGFFcH8Rfh /6asAsiDKi1RLQlT44lhYpBPuDurXyyTbCHea4jtGLw5FEFBXWP//J0rvGjb7AbY iw3DimuYGfPLlbLFUww5qLPUv+EcubexHu1NePDTejh0BLvs7VH0e6wXR6/mJH3M VGiRtSTbksFv+T9xdEmdfE1IhM4CG5I+mhd5v5py7iLtJNXyVLMsbiUkSTFA/y8R TjKhK0MIjQ0a4+IdMU8g48YjSP4bq3DKV/mTn0UyBD+eVkZmrWmGsTMhnKs2cfO9 CvbPkHdO8hwhX9iAbsV4Peu98ixgSOP2eG13y6/fRhjBBdMZBPRN4lpHRDRqeUG1 311XD6HFAIOyRlVYx+INenTrMtsvsMkrzePqB6dQjwvJv7joEQkrudT/hRAk0AXg NMX1BDGif8YXNWOgmwMu3ZZVZiiJkUZP2xkd03v3Hh7/hkNvPpXRdjIdsEKgg85J cuWOcZv8Az4=z1Yt -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . 8) - aarch64, ppc64le, x86_64 3. Background ========= Library for rendering dynamic web content in Qt5 C++ and QML applications

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

other

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Natalie Silvanovich of Google Project Zero

SOURCES

LAST UPDATE DATE

2026-08-28T22:21:46.039000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE